WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in HT Contact Form – Drag & Drop Form Builder for WordPress

The easiest drag & drop form builder for WordPress. Create contact forms, surveys, and lead capture forms in minutes with 38+ fields and 21+ integ …

9Reported vulnerabilities
9.8Highest CVSS score
2.9.4Latest version
10,000+Active installs

What to do now

Update HT Contact Form – Drag & Drop Form Builder for WordPress to 2.9.3 or later. 9 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 2, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2025-7360 Critical 9.8 1.4% Before 2.2.2 2.2.2 July 15, 2025
CVE-2025-7340 Critical 9.8 1.7% Before 2.2.2 2.2.2 July 15, 2025
CVE-2025-7341 Critical 9.8 1.1% Before 2.2.2 2.2.2 July 15, 2025
CVE-2023-0484 Medium 4.3 0.3% Before 1.1.6 1.1.6 March 27, 2023
CVE-2026-7052 High 7.2 0.3% 0 to 2.8.2 (inclusive) 2.8.3 May 28, 2026
CVE-2026-42728 High 7.2 0.2% 2.8.2 and earlier 2.8.3 May 20, 2026
CVE-2025-54015 Medium 6.6 0.5% 2.0.0 and earlier 2.1.0 July 16, 2025
CVE-2025-24726 Medium 6.4 0.3% 1.2.1 and earlier 1.2.2 January 24, 2025
CVE-2026-14206 Medium 5.3 0.3% 2.9.2 and earlier 2.9.3 August 6, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.